bugdavfs2 - Bugs: bug #58459, cookie handling in webdav.c...

 
 

bug #58459: cookie handling in webdav.c revision 1.35

Submitted by:  None
Submitted on:  Thu 28 May 2020 06:46:23 AM UTC  
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Werner Baumann <wbaumann>
Open/Closed:  Open

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 08 Jun 2020 09:50:34 AM UTC, comment #1: 

I fixed the issues in the CVS-sources.

Some comments:
[1] This is the easy one. The list seperator in HTTP-headers is the comma, so it is a bug in RFC6265. But after 20 years and three RFC's this bug is still there. So applications will have to follow that buggy RFC.

[2] This was more difficult. In HTTP each header should only appear once. Multiple values should be send as list, seperated by commas. But because of that stupid date-format lists are not possible with Set-Cookie. So more than on Set-Cookie header is possible and I have to scan all headers for that one.

[3] If required the cookie_list is created at program start and then needed until the end. When the program terminates the operating system will free all of its memory. No need to write code for this. Debugging tools may have problems to notice the differnce.

Werner

Werner Baumann <wbaumann>
Project AdministratorIn charge of this item.
Thu 28 May 2020 06:46:23 AM UTC, original submission:  

If activating the usage of cookies, I see some misbehavior.

[1] function add_header() uses comma instead of semicolon for multiple cookie
In RFC6265 section 4.2.1 it is specified, that a semicolon should be used for separation of multiple cookies

https://tools.ietf.org/html/rfc6265#section-4.2.1

[2] function get_cookies() uses comma to parse multiple cookie-pairs
In RFC6265 section 4.1.1 it is specified, that a semicolon should be used for separation of multiple cookies
A comma might be used in the Expire value e.g.
Set-Cookie: lang=; Expires=Sun, 06 Nov 1994 08:49:37 GMT

https://tools.ietf.org/html/rfc6265#section-4.1.1

[3] the variable cookie_list is not freed
It might be useful to cleanup the allocated resources in order to identify real memory leaks

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by wbaumann (Posted a comment)
  • -email is unavailable- added by sreschke (SRE)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-06-08 wbaumann StatusNone => Fixed
        Assigned toNone => wbaumann
    2020-06-06 sreschke Carbon-Copy- => Added sebastianreschke@yahoo.de

    Back to the top


    Powered by Savane 3.7